Crate core_auth 

Pluggable authentication backends for vault unlock.

Provides a trait-based dispatch system for vault authentication methods. The AuthDispatcher tries non-interactive backends (SSH-agent, future TPM) first, falling back to password entry when no automatic method is available.

The SSH-agent backend is currently a stub — actual agent communication is future work. The trait and types are defined to establish the contract.

Re-exports

pub use password_wrap::PASSWORD_WRAP_VERSION;

pub use password_wrap::PasswordWrapBlob;

pub use vault_meta::EnrolledFactor;

pub use vault_meta::VAULT_META_VERSION;

pub use vault_meta::VaultInitMode;

pub use vault_meta::VaultMetadata;

Modules

password_wrap

Password-wrap blob: AES-256-GCM wrapped master key under Argon2id-derived KEK.

vault_meta

Vault metadata: tracks enrolled factors, auth policy, and init mode.

Structs

AuthDispatcher

Dispatches vault unlock across registered authentication backends.

EnrollmentBlob

Parsed enrollment blob.

PasswordBackend

Password-based vault authentication.

SshAgentBackend

SSH-agent backed vault authentication.

UnlockOutcome

Result of a successful backend unlock.

Enums

AuthError

Errors from authentication backends.

AuthInteraction

What kind of user interaction a backend requires.

FactorContribution

Which piece of the unlock this backend is providing.

IpcUnlockStrategy

How the master key should be sent to daemon-secrets.

SshKeyType

Supported SSH key types for vault unlock.

Constants

ENROLLMENT_VERSION

Version of the enrollment blob format.

Traits

VaultAuthBackend

A pluggable authentication backend for vault unlock.